Vulnerability-Lookup

CVE-2026-12413 (GCVE-0-2026-12413)

Vulnerability from cvelistv5 – Published: 2026-07-02 21:19 – Updated: 2026-07-07 17:02

Title

IKEv2 Denial of Service via malformed fragmentation

Summary

An invalidly formatted IKEv2 fragment causes the Libreswan pluto daemon to crash and restart. Continued exploitation would cause a denial of service. The function reassemble_v2_incoming_fragments() would ignore unknown outer payloads but still store these in a fixed size array msg_digest.digest[PAYLIMIT]. An off-by-one error in the assertion PASSERT(logger, md->digest_roof < elemsof(md->digest)) causes the daemon to abort. No remote code execution is possible. Any configuration that allows IKEv2 connections that do not set fragmentation=no are vulnerable. IKEv1 is not affected.

Severity

7.5 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

SSVC

Exploitation: none Automatable: yes Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-07-06 18:12 UTC

CWE

CWE-193 - Off-by-one Error
CWE-617 - Reachable Assertion

Assigner

libreswan mitre root

References

2 references

URL	Tags
https://libreswan.org/security/CVE-2026-12413/CVE…
https://libreswan.org/security/CVE-2026-12413/

Impacted products

1 product

Vendor	Product	Version	CPE status
The Libreswan Project	libreswan	Affected: 4.6 , ≤ 5.3 (semver) Unaffected: 5.3.1 (semver)	guessed

Credits

Hu Xinyao

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-12413",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-07-06T18:12:21.499364Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-07-07T17:02:12.976Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "libreswan",
          "vendor": "The Libreswan Project",
          "versions": [
            {
              "lessThanOrEqual": "5.3",
              "status": "affected",
              "version": "4.6",
              "versionType": "semver"
            },
            {
              "status": "unaffected",
              "version": "5.3.1",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Hu Xinyao"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "An invalidly formatted IKEv2 fragment causes the Libreswan pluto daemon to crash and restart. Continued exploitation would cause a denial of service. The function reassemble_v2_incoming_fragments() would ignore unknown outer payloads but still store these in a fixed size array msg_digest.digest[PAYLIMIT]. An off-by-one error in the assertion PASSERT(logger, md-\u003edigest_roof \u003c elemsof(md-\u003edigest)) causes the daemon to abort. No remote code execution is possible. Any configuration that allows IKEv2 connections that do not set fragmentation=no are vulnerable. IKEv1 is not affected."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        },
        {
          "other": {
            "content": {
              "description": "Vendor-assessed severity. The daemon automatically restarts after the crash, requiring continued exploitation for sustained denial of service.",
              "value": "MEDIUM"
            },
            "type": "vendorSeverity"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-193",
              "description": "Off-by-one Error",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-617",
              "description": "Reachable Assertion",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-07-02T21:19:22.177Z",
        "orgId": "d42dc95b-23f1-4e06-9076-20753a0fb0df",
        "shortName": "libreswan"
      },
      "references": [
        {
          "name": "Libreswan Security Advisory",
          "url": "https://libreswan.org/security/CVE-2026-12413/CVE-2026-12413.txt"
        },
        {
          "name": "Libreswan CVE-2026-12413 Patches",
          "url": "https://libreswan.org/security/CVE-2026-12413/"
        }
      ],
      "solutions": [
        {
          "lang": "en",
          "value": "Upgrade to libreswan 5.3.1 or later. Patches for libreswan 4.15 and 5.3 are available at https://libreswan.org"
        }
      ],
      "timeline": [
        {
          "lang": "en",
          "time": "2026-06-16T00:00:00.000Z",
          "value": "Libreswan notified of the issue via security@libreswan.org"
        },
        {
          "lang": "en",
          "time": "2026-06-16T00:00:00.000Z",
          "value": "Advanced notice given to supported customers and distributions"
        },
        {
          "lang": "en",
          "time": "2026-06-24T00:00:00.000Z",
          "value": "Public announcement and release of libreswan 5.3.1"
        }
      ],
      "title": "IKEv2 Denial of Service via malformed fragmentation",
      "workarounds": [
        {
          "lang": "en",
          "value": "If fragmentation is not needed, fragmentation=no can be added to all IKEv2 configurations. If fragmentation is needed, no workaround is possible and the fix needs to be applied."
        }
      ],
      "x_generator": {
        "engine": "cvelib 1.8.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "d42dc95b-23f1-4e06-9076-20753a0fb0df",
    "assignerShortName": "libreswan",
    "cveId": "CVE-2026-12413",
    "datePublished": "2026-07-02T21:19:22.177Z",
    "dateReserved": "2026-06-16T15:52:12.674Z",
    "dateUpdated": "2026-07-07T17:02:12.976Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-12413",
      "date": "2026-09-16",
      "epss": "0.00598",
      "percentile": "0.47043"
    },
    "microsoft_vex": {
      "current_release_date": "2026-07-09T14:39:45.000Z",
      "cve": "CVE-2026-12413",
      "id": "msrc_CVE-2026-12413",
      "initial_release_date": "2026-07-02T00:00:00.000Z",
      "product_status:fixed": "1",
      "product_status:known_affected": "1",
      "source": "Microsoft CSAF VEX",
      "status": "final",
      "title": "IKEv2 Denial of Service via malformed fragmentation",
      "url": "https://msrc.microsoft.com/csaf/vex/2026/msrc_cve-2026-12413.json",
      "version": "2"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2026-12413\",\"sourceIdentifier\":\"d42dc95b-23f1-4e06-9076-20753a0fb0df\",\"published\":\"2026-07-02T22:16:42.517\",\"lastModified\":\"2026-07-08T18:52:42.920\",\"vulnStatus\":\"Analyzed\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"An invalidly formatted IKEv2 fragment causes the Libreswan pluto daemon to crash and restart. Continued exploitation would cause a denial of service. The function reassemble_v2_incoming_fragments() would ignore unknown outer payloads but still store these in a fixed size array msg_digest.digest[PAYLIMIT]. An off-by-one error in the assertion PASSERT(logger, md-\u003edigest_roof \u003c elemsof(md-\u003edigest)) causes the daemon to abort. No remote code execution is possible. Any configuration that allows IKEv2 connections that do not set fragmentation=no are vulnerable. IKEv1 is not affected.\"}],\"affected\":[{\"source\":\"d42dc95b-23f1-4e06-9076-20753a0fb0df\",\"affectedData\":[{\"vendor\":\"The Libreswan Project\",\"product\":\"libreswan\",\"defaultStatus\":\"unaffected\",\"versions\":[{\"version\":\"4.6\",\"lessThanOrEqual\":\"5.3\",\"versionType\":\"semver\",\"status\":\"affected\"},{\"version\":\"5.3.1\",\"versionType\":\"semver\",\"status\":\"unaffected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"d42dc95b-23f1-4e06-9076-20753a0fb0df\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H\",\"baseScore\":7.5,\"baseSeverity\":\"HIGH\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":3.9,\"impactScore\":3.6}],\"ssvcV203\":[{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"ssvcData\":{\"timestamp\":\"2026-07-06T18:12:21.499364Z\",\"id\":\"CVE-2026-12413\",\"options\":[{\"exploitation\":\"none\"},{\"automatable\":\"yes\"},{\"technicalImpact\":\"partial\"}],\"role\":\"CISA Coordinator\",\"version\":\"2.0.3\"}}]},\"weaknesses\":[{\"source\":\"d42dc95b-23f1-4e06-9076-20753a0fb0df\",\"type\":\"Secondary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-193\"},{\"lang\":\"en\",\"value\":\"CWE-617\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:libreswan:libreswan:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"4.6\",\"versionEndExcluding\":\"5.3.1\",\"matchCriteriaId\":\"535F926A-021B-40BB-929F-618252622EAB\"}]}]}],\"references\":[{\"url\":\"https://libreswan.org/security/CVE-2026-12413/\",\"source\":\"d42dc95b-23f1-4e06-9076-20753a0fb0df\",\"tags\":[\"Vendor Advisory\"]},{\"url\":\"https://libreswan.org/security/CVE-2026-12413/CVE-2026-12413.txt\",\"source\":\"d42dc95b-23f1-4e06-9076-20753a0fb0df\",\"tags\":[\"Vendor Advisory\",\"Mitigation\"]}]}}",
    "redhat_vex": {
      "aggregate_severity": "Important",
      "current_release_date": "2026-09-09T15:19:06+00:00",
      "cve": "CVE-2026-12413",
      "id": "CVE-2026-12413",
      "initial_release_date": "2026-06-24T00:00:00+00:00",
      "product_status:fixed": "88",
      "product_status:known_affected": "1",
      "product_status:known_not_affected": "35",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "librenswan: IKEv2 Denial of Service via malformed fragmentation",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-12413.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "important",
      "current_release_date": "2026-07-27T23:42:27Z",
      "cve": "CVE-2026-12413",
      "id": "CVE-2026-12413",
      "initial_release_date": "2026-07-27T17:08:46Z",
      "product_status:recommended": "4",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2026-12413",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2026-12413.json",
      "version": "3"
    },
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2026-12413\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"yes\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2026-07-06T18:12:21.499364Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2026-07-06T18:12:22.546Z\"}}], \"cna\": {\"title\": \"IKEv2 Denial of Service via malformed fragmentation\", \"credits\": [{\"lang\": \"en\", \"type\": \"finder\", \"value\": \"Hu Xinyao\"}], \"metrics\": [{\"format\": \"CVSS\", \"cvssV3_1\": {\"scope\": \"UNCHANGED\", \"version\": \"3.1\", \"baseScore\": 7.5, \"attackVector\": \"NETWORK\", \"baseSeverity\": \"HIGH\", \"vectorString\": \"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H\", \"integrityImpact\": \"NONE\", \"userInteraction\": \"NONE\", \"attackComplexity\": \"LOW\", \"availabilityImpact\": \"HIGH\", \"privilegesRequired\": \"NONE\", \"confidentialityImpact\": \"NONE\"}, \"scenarios\": [{\"lang\": \"en\", \"value\": \"GENERAL\"}]}, {\"other\": {\"type\": \"vendorSeverity\", \"content\": {\"value\": \"MEDIUM\", \"description\": \"Vendor-assessed severity. The daemon automatically restarts after the crash, requiring continued exploitation for sustained denial of service.\"}}}], \"affected\": [{\"vendor\": \"The Libreswan Project\", \"product\": \"libreswan\", \"versions\": [{\"status\": \"affected\", \"version\": \"4.6\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"5.3\"}, {\"status\": \"unaffected\", \"version\": \"5.3.1\", \"versionType\": \"semver\"}], \"defaultStatus\": \"unaffected\"}], \"timeline\": [{\"lang\": \"en\", \"time\": \"2026-06-16T00:00:00.000Z\", \"value\": \"Libreswan notified of the issue via security@libreswan.org\"}, {\"lang\": \"en\", \"time\": \"2026-06-16T00:00:00.000Z\", \"value\": \"Advanced notice given to supported customers and distributions\"}, {\"lang\": \"en\", \"time\": \"2026-06-24T00:00:00.000Z\", \"value\": \"Public announcement and release of libreswan 5.3.1\"}], \"solutions\": [{\"lang\": \"en\", \"value\": \"Upgrade to libreswan 5.3.1 or later. Patches for libreswan 4.15 and 5.3 are available at https://libreswan.org\"}], \"references\": [{\"url\": \"https://libreswan.org/security/CVE-2026-12413/CVE-2026-12413.txt\", \"name\": \"Libreswan Security Advisory\"}, {\"url\": \"https://libreswan.org/security/CVE-2026-12413/\", \"name\": \"Libreswan CVE-2026-12413 Patches\"}], \"workarounds\": [{\"lang\": \"en\", \"value\": \"If fragmentation is not needed, fragmentation=no can be added to all IKEv2 configurations. If fragmentation is needed, no workaround is possible and the fix needs to be applied.\"}], \"x_generator\": {\"engine\": \"cvelib 1.8.0\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"An invalidly formatted IKEv2 fragment causes the Libreswan pluto daemon to crash and restart. Continued exploitation would cause a denial of service. The function reassemble_v2_incoming_fragments() would ignore unknown outer payloads but still store these in a fixed size array msg_digest.digest[PAYLIMIT]. An off-by-one error in the assertion PASSERT(logger, md-\u003edigest_roof \u003c elemsof(md-\u003edigest)) causes the daemon to abort. No remote code execution is possible. Any configuration that allows IKEv2 connections that do not set fragmentation=no are vulnerable. IKEv1 is not affected.\"}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-193\", \"description\": \"Off-by-one Error\"}]}, {\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-617\", \"description\": \"Reachable Assertion\"}]}], \"providerMetadata\": {\"orgId\": \"d42dc95b-23f1-4e06-9076-20753a0fb0df\", \"shortName\": \"libreswan\", \"dateUpdated\": \"2026-07-02T21:19:22.177Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2026-12413\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2026-07-07T17:02:12.976Z\", \"dateReserved\": \"2026-06-16T15:52:12.674Z\", \"assignerOrgId\": \"d42dc95b-23f1-4e06-9076-20753a0fb0df\", \"datePublished\": \"2026-07-02T21:19:22.177Z\", \"assignerShortName\": \"libreswan\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}

RHSA-2026:46398

Vulnerability from csaf_opensuse - Published: 2026-07-27 00:00 - Updated: 2026-09-16 18:40

Summary

security update for libreswan

Severity

Important

Scope

4 vulnerabilities in this advisory, including CVE-2026-12413.

CVE-2026-12413

Recommended: 2 products

Open the full advisory

RHSA-2026:57741

Vulnerability from csaf_opensuse - Published: 2026-08-20 00:00 - Updated: 2026-09-16 18:45

Summary

security update for libreswan

Severity

Important

Scope

4 vulnerabilities in this advisory, including CVE-2026-12413.

CVE-2026-12413

Recommended: 1 product

Open the full advisory

RHSA-2026:46986

Vulnerability from csaf_redhat - Published: 2026-07-27 23:31 - Updated: 2026-09-16 19:34

Summary

Red Hat Security Advisory: libreswan security update

Severity

Important

Scope

4 vulnerabilities in this advisory, including CVE-2026-12413.

CVE-2026-12413

A flaw was found in Libreswan's IKEv2 fragment reassembly mechanism. When a VPN gateway processes incoming split network packets (fragments) containing unexpected data, an off-by-one boundary validation error triggers an internal program safety check (assertion failure). A remote, unauthenticated attacker can exploit this by sending a specific sequence of malformed IKEv2 fragments to an exposed gateway, causing the Libreswan daemon to immediately crash and restart. While this flaw does not allow data theft or unauthorized system access, a continuous stream of these packets will lead to a persistent Denial of Service (DoS) for legitimate VPN users.

7.5 (High)


                
                  CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Fixed: 13 products

https://access.redhat.com/errata/RHSA-2026:46986

Open the full advisory

RHSA-2026:55449

Vulnerability from csaf_redhat - Published: 2026-08-17 02:28 - Updated: 2026-09-16 19:34

Summary

Red Hat Security Advisory: libreswan security update

Severity

Important

Scope

4 vulnerabilities in this advisory, including CVE-2026-12413.

CVE-2026-12413

7.5 (High)


                
                  CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Fixed: 5 products Known not affected: 8 products

https://access.redhat.com/errata/RHSA-2026:55449

Open the full advisory

RHSA-2026:61258

Vulnerability from csaf_redhat - Published: 2026-08-31 04:16 - Updated: 2026-09-16 19:35

Summary

Red Hat Security Advisory: libreswan security update

Severity

Important

Scope

4 vulnerabilities in this advisory, including CVE-2026-12413.

CVE-2026-12413

7.5 (High)


                
                  CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Fixed: 5 products Known not affected: 8 products

https://access.redhat.com/errata/RHSA-2026:61258

Open the full advisory

RHSA-2026:61779

Vulnerability from csaf_redhat - Published: 2026-08-31 20:38 - Updated: 2026-09-16 19:35

Summary

Red Hat Security Advisory: libreswan security update

Severity

Important

Scope

4 vulnerabilities in this advisory, including CVE-2026-12413.

CVE-2026-12413

7.5 (High)


                
                  CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Fixed: 5 products Known not affected: 8 products

https://access.redhat.com/errata/RHSA-2026:61779

Open the full advisory

RHSA-2026:63041

Vulnerability from csaf_redhat - Published: 2026-09-08 15:01 - Updated: 2026-09-16 19:35

Summary

Red Hat Security Advisory: OpenShift Container Platform 4.21.32 bug fix and security update

Severity

Important

Scope

7 vulnerabilities in this advisory, including CVE-2026-12413.

CVE-2026-12413

7.5 (High)


                
                  CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Fixed: 4 products

https://access.redhat.com/errata/RHSA-2026:63041

Open the full advisory

RHSA-2026:63044

Vulnerability from csaf_redhat - Published: 2026-09-09 10:01 - Updated: 2026-09-16 19:35

Summary

Red Hat Security Advisory: OpenShift Container Platform 4.19.46 bug fix and security update

Severity

Important

Scope

8 vulnerabilities in this advisory, including CVE-2026-12413.

CVE-2026-12413

7.5 (High)


                
                  CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Fixed: 4 products

https://access.redhat.com/errata/RHSA-2026:63044

Open the full advisory

RHSA-2026:63100

Vulnerability from csaf_redhat - Published: 2026-09-08 12:01 - Updated: 2026-09-16 19:35

Summary

Red Hat Security Advisory: OpenShift Container Platform 4.20.37 bug fix and security update

Severity

Important

Scope

6 vulnerabilities in this advisory, including CVE-2026-12413.

CVE-2026-12413

7.5 (High)


                
                  CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Fixed: 4 products

https://access.redhat.com/errata/RHSA-2026:63100

Open the full advisory

rlsa-2026:46396

Vulnerability from osv_rocky

Published

2026-07-28 06:01

Modified

2026-08-11 06:08

Summary

Important: libreswan security update

Details

Libreswan is an implementation of IPsec and IKE for Linux. IPsec is the Internet Protocol Security and uses strong cryptography to provide both authentication and encryption services. These services allow you to build secure tunnels through untrusted networks such as virtual private network (VPN).

Security Fix(es):

librenswan: IKEv1 Denial of Service via RSA-SHA1 (PKCS#1 Version 1.5 Encrypted) authentication payload (CVE-2026-50721)
librenswan: IKEv2 Denial of Service via RSA-SHA1 (PKCS#1 RSASSA-PKCS1-v1_5) authentication payload (CVE-2026-50722)
librenswan: IKEv2 Denial of Service via malformed fragmentation (CVE-2026-12413)
libreswan: badly formatted X.509 certificate can cause an assertion failure that crashes the daemon process (CVE-2026-14957)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Severity

7.5 (High)


                    
                      CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Credits

Rocky Enterprise Software Foundation

Red Hat

References

URL

Type

	https://errata.rockylinux.org/RLSA-2026:46396	ADVISORY
	https://bugzilla.redhat.com/show_bug.cgi?id=2494147	REPORT
	https://bugzilla.redhat.com/show_bug.cgi?id=2494148	REPORT
	https://bugzilla.redhat.com/show_bug.cgi?id=2494149	REPORT
	https://bugzilla.redhat.com/show_bug.cgi?id=2501764	REPORT
	https://access.redhat.com/errata/RHSA-2026:46396	ADVISORY

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "Rocky Linux:8",
        "name": "libreswan",
        "purl": "pkg:rpm/rocky-linux/libreswan?distro=rocky-linux-8\u0026epoch=0"
      },
      "ranges": [
        {
          "database_specific": {
            "yum_repository": "AppStream"
          },
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "0:4.12-2.el8_10.6"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "credits": [
    {
      "name": "Rocky Enterprise Software Foundation"
    },
    {
      "name": "Red Hat"
    }
  ],
  "database_specific": {
    "license": "CC-BY-4.0",
    "license_url": "https://creativecommons.org/licenses/by/4.0/",
    "source_advisory": "RHSA-2026:46396"
  },
  "details": "Libreswan is an implementation of IPsec and IKE for Linux. IPsec is the Internet Protocol Security and uses strong cryptography to provide both authentication and encryption services. These services allow you to build secure tunnels through untrusted networks such as virtual private network (VPN).\n\nSecurity Fix(es):\n\n* librenswan: IKEv1 Denial of Service via RSA-SHA1 (PKCS#1 Version 1.5 Encrypted) authentication payload (CVE-2026-50721)\n\n* librenswan: IKEv2 Denial of Service via RSA-SHA1 (PKCS#1 RSASSA-PKCS1-v1_5) authentication payload (CVE-2026-50722)\n\n* librenswan: IKEv2 Denial of Service via malformed fragmentation (CVE-2026-12413)\n\n* libreswan: badly formatted X.509 certificate can cause an assertion failure that crashes the daemon process (CVE-2026-14957)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.",
  "id": "RLSA-2026:46396",
  "modified": "2026-08-11T06:08:26.116989Z",
  "published": "2026-07-28T06:01:06.284655Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://errata.rockylinux.org/RLSA-2026:46396"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2494147"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2494148"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2494149"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2501764"
    },
    {
      "type": "ADVISORY",
      "url": "https://access.redhat.com/errata/RHSA-2026:46396"
    }
  ],
  "schema_version": "1.7.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Important: libreswan security update",
  "upstream": [
    "CVE-2026-12413",
    "CVE-2026-14957",
    "CVE-2026-50721",
    "CVE-2026-50722"
  ]
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted

CVE-2026-12413 (GCVE-0-2026-12413)

Vulnerability from osv_rocky

Tags

Sightings

Nomenclature

Related by attack behaviour